They buy with stolen credit cards, sell at a loss which is all profit to them. Cars are legit, but they didn't pay for them. Markdown price is all profit
It's a grey area (again, as I removeded elsewhere, because game companies are also against used sales and cross-region sales).
It can be stolen credit cards.
It can also be:
Games purchased during an unprecedented sale, then resold at a profit still well below current MSRP. Big game companies hate this.
Games purchased in one country to be resold in another, non-region-locked country. (note, my removed includes region locking)
Games purchased in bulk directly from the company or from an authorized reseller. Can relate to #2 as well.
But because everyone involved is in a grey area, there's not as much transparency from anyone exactly how many this is. G2A argued for years it was virtually zero, then admitted it's a bit higher than that. Is it 10%, 50%, somewhere in between? We actually don't know.